feat: amanita external probe (timer + vx-only key)

2026-09-18 15:11:41 +02:00 · 2026-09-18 15:11:41 +02:00 · d27c7254af
commit d27c7254af
parent 7691ac3065
6 changed files with 416 additions and 0 deletions
--- a/scripts/amanita-probe/install-amanita-probe.sh
+++ b/scripts/amanita-probe/install-amanita-probe.sh
@ -0,0 +1,131 @@
+#!/usr/bin/env bash
+# Install koopa-amanita-probe (hernani on koopa):
+#   - ~/.local/bin/koopa-amanita-probe
+#   - user systemd timer ~15s → ICMP+SSH last-alive log
+#   - optional: generate ~/.ssh/id_ed25519_amanita_probe + Host amanita-probe
+#   - optional: print restricted pubkey line for amanita vx authorized_keys
+#
+# On koopa as hernani (after laptop push + pull into ~/src/koopa/koopa-admin-log):
+#   ./scripts/amanita-probe/install-amanita-probe.sh
+#   ./scripts/amanita-probe/install-amanita-probe.sh --keygen   # if key missing
+#   ./scripts/amanita-probe/install-amanita-probe.sh --print-pubkey
+#
+# Key install on amanita is separate (vx authorized_keys) — see README.
+
+set -euo pipefail
+
+ROOT=$(cd "$(dirname "$0")" && pwd)
+REPO_ROOT=$(cd "$ROOT/../.." && pwd)
+SRC="$ROOT/koopa-amanita-probe.sh"
+UNIT_SRC_DIR="$REPO_ROOT/configs/systemd/user"
+BIN_DIR="${HOME}/.local/bin"
+DEST="$BIN_DIR/koopa-amanita-probe"
+UNIT_DIR="${XDG_CONFIG_HOME:-$HOME/.config}/systemd/user"
+KEY="${AMANITA_PROBE_KEY:-${HOME}/.ssh/id_ed25519_amanita_probe}"
+SSH_CONFIG="${HOME}/.ssh/config"
+HOST_MARKER_BEGIN="# >>> amanita-probe (koopa-admin-log) >>>"
+HOST_MARKER_END="# <<< amanita-probe (koopa-admin-log) <<<"
+DO_KEYGEN=0
+DO_PRINT=0
+DO_UNITS=1
+
+for arg in "$@"; do
+  case "$arg" in
+    --keygen) DO_KEYGEN=1 ;;
+    --print-pubkey) DO_PRINT=1 ;;
+    --no-units) DO_UNITS=0 ;;
+    -h|--help)
+      sed -n '2,16p' "$0" | sed 's/^# \?//'
+      exit 0
+      ;;
+    *)
+      echo "unknown arg: $arg" >&2
+      exit 2
+      ;;
+  esac
+done
+
+if [ ! -f "$SRC" ]; then
+  echo "missing $SRC" >&2
+  exit 1
+fi
+
+mkdir -p "$BIN_DIR" "$UNIT_DIR" "${HOME}/.ssh"
+chmod 700 "${HOME}/.ssh" 2>/dev/null || true
+
+install -m 0755 "$SRC" "$DEST"
+echo "installed $DEST"
+
+if [ "$DO_KEYGEN" -eq 1 ]; then
+  if [ -f "$KEY" ]; then
+    echo "key exists: $KEY (skip --keygen)"
+  else
+    ssh-keygen -t ed25519 -a 64 -f "$KEY" -N "" \
+      -C "koopa-amanita-probe@hernani-$(hostname -s 2>/dev/null || echo koopa)"
+    chmod 600 "$KEY" "${KEY}.pub"
+    echo "generated $KEY"
+  fi
+fi
+
+if [ -f "$KEY" ]; then
+  # Ensure Host block for manual/debug ssh (timer uses -i directly)
+  touch "$SSH_CONFIG"
+  chmod 600 "$SSH_CONFIG" 2>/dev/null || true
+  if grep -qF "$HOST_MARKER_BEGIN" "$SSH_CONFIG" 2>/dev/null; then
+    tmp=$(mktemp)
+    awk -v b="$HOST_MARKER_BEGIN" -v e="$HOST_MARKER_END" '
+      $0 == b {skip=1; next}
+      $0 == e {skip=0; next}
+      !skip {print}
+    ' "$SSH_CONFIG" >"$tmp"
+    mv "$tmp" "$SSH_CONFIG"
+  fi
+  {
+    echo ""
+    echo "$HOST_MARKER_BEGIN"
+    echo "Host amanita-probe"
+    echo "  Hostname 192.168.100.6"
+    echo "  User vx"
+    echo "  IdentityFile $KEY"
+    echo "  IdentitiesOnly yes"
+    echo "  BatchMode yes"
+    echo "  PreferredAuthentications publickey"
+    echo "  ConnectTimeout 5"
+    echo "$HOST_MARKER_END"
+  } >>"$SSH_CONFIG"
+  echo "updated $SSH_CONFIG Host amanita-probe"
+fi
+
+if [ "$DO_PRINT" -eq 1 ] || [ "$DO_KEYGEN" -eq 1 ]; then
+  if [ ! -f "${KEY}.pub" ]; then
+    echo "missing ${KEY}.pub — run with --keygen first" >&2
+    exit 1
+  fi
+  pub="$(awk '{print $1, $2}' "${KEY}.pub")"
+  comment="$(awk '{print $3}' "${KEY}.pub")"
+  echo ""
+  echo "=== paste ONE line into amanita:~vx/.ssh/authorized_keys ==="
+  printf 'from="192.168.100.95",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty,command="/bin/cat /var/lib/amanita/heartbeat.last" %s %s\n' \
+    "$pub" "${comment:-koopa-amanita-probe}"
+  echo "=== end ==="
+fi
+
+if [ "$DO_UNITS" -eq 1 ]; then
+  for u in koopa-amanita-probe.service koopa-amanita-probe.timer; do
+    if [ ! -f "$UNIT_SRC_DIR/$u" ]; then
+      echo "missing unit $UNIT_SRC_DIR/$u" >&2
+      exit 1
+    fi
+    install -m 0644 "$UNIT_SRC_DIR/$u" "$UNIT_DIR/$u"
+    echo "installed $UNIT_DIR/$u"
+  done
+  systemctl --user daemon-reload
+  systemctl --user enable --now koopa-amanita-probe.timer
+  systemctl --user start koopa-amanita-probe.service || true
+  echo "timer: $(systemctl --user is-active koopa-amanita-probe.timer 2>/dev/null || echo unknown)"
+  echo "probe once: $DEST once"
+  "$DEST" once || true
+  "$DEST" status || true
+fi
+
+echo "done. log: ~/.local/state/amanita-probe/amanita-probe.log"